I dove into this a bit more, and learned that Kohana's html::attributes() function already escapes things.  In fact, it's a little more comprehensive than SafeStrings's for_html_attr() - in particular, it uses PHP's htmlspecialchars(), which escapes not only quotes but also <, >, and & while ensuring the charset is correct.

So:
- no changes for this pull; we're already safe.
- perhaps we should revise SafeStrings's for_html_attr() to use htmlspecialchars().  Is there a specific thing we're working around with <, >, and &?